services:
##########
# Database
##########
  authentik-db:
    image: docker.io/library/postgres:16-alpine
    restart: unless-stopped
    container_name: authentik-db
    environment:
      POSTGRES_DB: ${PG_DB}
      POSTGRES_PASSWORD: ${PG_PASS}
      POSTGRES_USER: ${PG_USER}
    healthcheck:
      interval: 30s
      retries: 5
      start_period: 20s
      test:
      - CMD-SHELL
      - pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}
      timeout: 5s
    labels:
      rackpeek.name: authentik-db
      rackpeek.tags: database
    volumes:
    - /srv/docker/network/authentik/database:/var/lib/postgresql/data
    
##########
# Server
##########
  authentik-server:
    command: server
    depends_on:
      authentik-db:
        condition: service_healthy
    image: ghcr.io/goauthentik/server:${AUTHENTIK_TAG}
    container_name: authentik-server
    ports:
    - 9000:9000
    - 9443:9443
    restart: unless-stopped
    shm_size: 512mb
    environment:
      AUTHENTIK_POSTGRESQL__HOST: authentik-db
      AUTHENTIK_POSTGRESQL__NAME: ${PG_DB}
      AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
      AUTHENTIK_POSTGRESQL__USER: ${PG_USER}
      AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY}
      #AUTHENTIK_ERROR_REPORTING__ENABLED: true    
      # SMTP server
      #AUTHENTIK_EMAIL__HOST: ${EMAIL_HOST}
      #AUTHENTIK_EMAIL__PORT: 587
      ## Optionally authenticate (don't add quotation marks to your password)
      #AUTHENTIK_EMAIL__USERNAME: ${EMAIL_USER}
      #AUTHENTIK_EMAIL__PASSWORD: ${EMAIL_PWD}
      #AUTHENTIK_EMAIL__TIMEOUT: 10
      ## Sender email address; verify that the domain is valid.
      #AUTHENTIK_EMAIL__FROM: ${EMAIL_FROM}
    
      #STARTTLS, also called explicit TLS, often uses port 587. Set AUTHENTIK_EMAIL__USE_TLS=true and leave AUTHENTIK_EMAIL__USE_SSL=false.
      #SSL or implicit TLS often uses port 465. Set AUTHENTIK_EMAIL__USE_SSL=true and leave AUTHENTIK_EMAIL__USE_TLS=false.
      #Plain SMTP without TLS should leave both settings disabled.
      ## STARTTLS / explicit TLS, usually on port 587
      #AUTHENTIK_EMAIL__USE_TLS: false
      ## Implicit TLS/SSL on the SMTP connection (`USE_SSL` is the variable name), usually on port 465
      #AUTHENTIK_EMAIL__USE_SSL: false
    volumes:
    - /srv/docker/network/authentik/data:/data
    - /srv/docker/network/authentik/custom-templates:/templates
    networks:
      - proxy-net
    labels:
      - homepage.group=Network
      - homepage.name=Authentik
      - homepage.icon=authentik.png
      - homepage.href=${AUTHENTIK_URL}
      - homepage.description= Identity Provider and SSO platform
      - homepage.widget.type=authentik
      - homepage.widget.url=${AUTHENTIK_URL}
      - homepage.widget.key=${AUTHENTIK_API_KEY}
      - homepage.widget.version=2
      - homepage.widget.fields=["users", "loginsLast24H", "failedLoginsLast24H"]
      - dockhand.url=${AUTHENTIK_URL}
      - rackpeek.tags=network
    
##########
# Worker
##########
  authentik-worker:
    command: worker
    image: ghcr.io/goauthentik/server:${AUTHENTIK_TAG}
    container_name: authentik-worker
    restart: unless-stopped
    shm_size: 512mb
    user: root
    depends_on:
      authentik-db:
        condition: service_healthy
    environment:
      AUTHENTIK_POSTGRESQL__HOST: authentik-db
      AUTHENTIK_POSTGRESQL__NAME: ${PG_DB}
      AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
      AUTHENTIK_POSTGRESQL__USER: ${PG_USER}
      AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY}
    volumes:
    #- /var/run/docker.sock:/var/run/docker.sock
    - /srv/docker/network/authentik/data:/data
    - /srv/docker/network/authentik/certs:/certs
    - /srv/docker/network/authentik/custom-templates:/templates
    labels:
      rackpeek.name: authentik-worker
      rackpeek.tags: services
    networks:
      - socket-net
      
networks:
  socket-net:
    external: true 
  proxy-net:
    external: true